Commit Graph

1413286 Commits

Author SHA1 Message Date
Denis Benato
063185ba32
platform/x86: asus-armoury: add support for GU605CR
Add TDP data for laptop model GU605CR.

Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20251225023841.1970513-1-denis.benato@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-12-29 14:30:47 +02:00
Tomáš Hnyk
cbf3dc3260
platform/x86: ideapad-laptop: Reassign KEY_CUT to KEY_SELECTIVE_SCREENSHOT
As per Lenovo documentation, Fn+Print-Screen should "Open the Snipping
tool" which corresponds to KEY_SELECTIVE_SCREENSHOT (keycode 0x27a). It
is currently assigned to KEY_CUT because keycodes under 248 were
preferred due to X11 limitations.

Reassign Fn+Print-Screen from KEY_CUT to KEY_SELECTIVE_SCREENSHOT.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220566
Signed-off-by: Tomáš Hnyk <tomashnyk@gmail.com>
Link: https://patch.msgid.link/20251226203454.405520-1-tomashnyk@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-12-29 13:56:14 +02:00
Yilin Chen
68ece1e2ce rust: dma: remove incorrect safety documentation
Removes a safety requirement that incorrectly states callers must
ensure the device does not access memory while the returned slice
is live, as this method doesn't return a slice.

Fixes: d37a39f607 ("rust: dma: add as_slice/write functions for CoherentAllocation")
Signed-off-by: Yilin Chen <1479826151@qq.com>
Link: https://patch.msgid.link/tencent_5195C0324923A2B67DEF8AE4B8E139BCB105@qq.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-29 12:41:02 +01:00
Matthew Maurer
2f4ca87469 docs: ABI: sysfs-devices-soc: Fix swapped sample values
The sample values for `family` and `machine` were swapped relative to
what the driver actually does, and doesn't match the field description.

Fixes: da5a70f351 ("Documentation: add information for new sysfs soc bus functionality")
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: Matthew Maurer <mmaurer@google.com>
Link: https://patch.msgid.link/20251226-soc-bindings-v4-2-2c2fac08f820@google.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-29 12:36:15 +01:00
Armin Wolf
d37cd54ebe
platform/x86: samsung-galaxybook: Fix problematic pointer cast
A user reported that reading the charge threshold on his device
results in very strange values (like 78497792) being returned.
The reason for this seems to be the fact that the driver casts
the int pointer to an u8 pointer, leaving the last 3 bytes of
the destination uninitialized. Fix this by using a temporary
variable instead.

Cc: stable@vger.kernel.org
Fixes: 56f529ce43 ("platform/x86: samsung-galaxybook: Add samsung-galaxybook driver")
Reported-by: Gianni Ceccarelli <dakkar@thenautilus.net>
Closes: https://lore.kernel.org/platform-driver-x86/20251228115556.14362d66@thenautilus.net/
Tested-by: Gianni Ceccarelli <dakkar@thenautilus.net>
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20251228214217.35972-1-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-12-29 12:55:50 +02:00
Wentao Liang
73cb5f6eaf pmdomain: imx: Fix reference count leak in imx_gpc_probe()
of_get_child_by_name() returns a node pointer with refcount incremented.
Use the __free() attribute to manage the pgc_node reference, ensuring
automatic of_node_put() cleanup when pgc_node goes out of scope.

This eliminates the need for explicit error handling paths and avoids
reference count leaks.

Fixes: 721cabf6c6 ("soc: imx: move PGC handling to a new GPC driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-12-29 11:41:09 +01:00
Macpaul Lin
305f254727 pmdomain: mtk-pm-domains: Fix spinlock recursion fix in probe
Remove scpsys_get_legacy_regmap(), replacing its usage with
of_find_node_with_property(). Explicitly call of_node_get(np) before each
of_find_node_with_property() to maintain correct node reference counting.

The of_find_node_with_property() function "consumes" its input by calling
of_node_put() internally, whether or not it finds a match.  Currently,
dev->of_node (np) is passed multiple times in sequence without incrementing
its reference count, causing it to be decremented multiple times and
risking early memory release.

Adding of_node_get(np) before each call balances the reference count,
preventing premature node release.

Fixes: c1bac49fe9 ("pmdomains: mtk-pm-domains: Fix spinlock recursion in probe")
Cc: stable@vger.kernel.org
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Tested-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-12-29 11:41:09 +01:00
Alice Ryhl
361e0ff456 rust_binder: remove spin_lock() in rust_shrink_free_page()
When forward-porting Rust Binder to 6.18, I neglected to take commit
fb56fdf8b9 ("mm/list_lru: split the lock to per-cgroup scope") into
account, and apparently I did not end up running the shrinker callback
when I sanity tested the driver before submission. This leads to crashes
like the following:

	============================================
	WARNING: possible recursive locking detected
	6.18.0-mainline-maybe-dirty #1 Tainted: G          IO
	--------------------------------------------
	kswapd0/68 is trying to acquire lock:
	ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: lock_list_lru_of_memcg+0x128/0x230

	but task is already holding lock:
	ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20

	other info that might help us debug this:
	 Possible unsafe locking scenario:

	       CPU0
	       ----
	  lock(&l->lock);
	  lock(&l->lock);

	 *** DEADLOCK ***

	 May be due to missing lock nesting notation

	3 locks held by kswapd0/68:
	 #0: ffffffff90d2e260 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x597/0x1160
	 #1: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20
	 #2: ffffffff90cf3680 (rcu_read_lock){....}-{1:2}, at: lock_list_lru_of_memcg+0x2d/0x230

To fix this, remove the spin_lock() call from rust_shrink_free_page().

Cc: stable <stable@kernel.org>
Fixes: eafedbc7c0 ("rust_binder: add Rust Binder driver")
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20251202-binder-shrink-unspin-v1-1-263efb9ad625@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-12-29 11:34:16 +01:00
Alexander Usyskin
420f423def mei: me: add nova lake point S DID
Add Nova Lake S device id.

Cc: stable <stable@kernel.org>
Co-developed-by: Tomas Winkler <tomasw@gmail.com>
Signed-off-by: Tomas Winkler <tomasw@gmail.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20251215105915.1672659-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-12-29 11:31:14 +01:00
Jonathan Cavitt
bed2a6bd20 drm/xe/guc: READ/WRITE_ONCE g2h_fence->done
Use READ_ONCE and WRITE_ONCE when operating on g2h_fence->done
to prevent the compiler from ignoring important modifications
to its value.

Fixes: dd08ebf6c3 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Suggested-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20251222201957.63245-5-jonathan.cavitt@intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
(cherry picked from commit b5179dbd1c)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2025-12-29 10:49:23 +01:00
Haibo Chen
ca643894a3 arm64: dts: add off-on-delay-us for usdhc2 regulator
For SD card, according to the spec requirement, for sd card power reset
operation, it need sd card supply voltage to be lower than 0.5v and keep
over 1ms, otherwise, next time power back the sd card supply voltage to
3.3v, sd card can't support SD3.0 mode again.

To match such requirement on imx8qm-mek board, add 4.8ms delay between
sd power off and power on.

Fixes: 307fd14d4b ("arm64: dts: imx: add imx8qm mek support")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 16:53:00 +08:00
Haibo Chen
e0d8678c2f arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level
light sensor isl29023 share the interrupt with lsm303arg, but these
two devices use different interrupt type. According to the datasheet
of these two devides, both support low level trigger type, so correct
the interrupt type here to avoid the following error log:

  irq: type mismatch, failed to map hwirq-11 for gpio@5d0c0000!

Fixes: 9918092cbb ("arm64: dts: imx8qm-mek: add i2c0 and children devices")
Fixes: 1d8a9f043a ("arm64: dts: imx8: use defines for interrupts")
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 16:53:00 +08:00
Rob Herring (Arm)
1a8e81a3bc ARM: dts: nxp: imx: Fix mc13xxx LED node names
Node names are supposed to be generic and use hexadecimal unit-addresses.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 16:51:03 +08:00
Carlos Song
cd0caaf200 arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP
I3C2 is in WAKEUP domain. Its pclk should be IMX95_CLK_BUSWAKEUP.

Fixes: 969497ebef ("arm64: dts: imx95: Add i3c1 and i3c2")
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 16:29:54 +08:00
Linus Torvalds
7839932417 sched_ext: Fixes for v6.19-rc3
- Fix uninitialized @ret on alloc_percpu() failure leading to ERR_PTR(0).
 
 - Fix PREEMPT_RT warning when bypass load balancer sends IPI to offline
   CPU by using resched_cpu() instead of resched_curr().
 
 - Fix comment referring to renamed function.
 
 - Update scx_show_state.py for scx_root and scx_aborting changes.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaVHQAw4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGdJ2AP9nLMUa5Rw2hpcKCLvPjgkqe5fDpNteWrQB3ni9
 bu28jQD/XGMwooJbATlDEgCtFqCH74QbddqUABJxBw4FE8qpUgw=
 =hp6J
 -----END PGP SIGNATURE-----

Merge tag 'sched_ext-for-6.19-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext fixes from Tejun Heo:

 - Fix uninitialized @ret on alloc_percpu() failure leading to
   ERR_PTR(0)

 - Fix PREEMPT_RT warning when bypass load balancer sends IPI to offline
   CPU by using resched_cpu() instead of resched_curr()

 - Fix comment referring to renamed function

 - Update scx_show_state.py for scx_root and scx_aborting changes

* tag 'sched_ext-for-6.19-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  tools/sched_ext: update scx_show_state.py for scx_aborting change
  tools/sched_ext: fix scx_show_state.py for scx_root change
  sched_ext: Use the resched_cpu() to replace resched_curr() in the bypass_lb_node()
  sched_ext: Fix some comments in ext.c
  sched_ext: fix uninitialized ret on alloc_percpu() failure
2025-12-28 17:21:36 -08:00
Linus Torvalds
bba0b6a1c4 cgroup: Fixes for v6.19-rc3
- cpuset: Fix spurious warning when disabling remote partition after CPU
   hotplug leaves subpartitions_cpus empty. Guard the warning and invalidate
   affected partitions.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaVHNBg4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGW13AQC7akGwBAjBbR5p0aoLXKl5vZ8UYiwH+7iyep2Z
 INn7ggEA/huYF4smSRk3oR8q7eiISa85mZc85EuVEAjPmBQhpAQ=
 =9UP0
 -----END PGP SIGNATURE-----

Merge tag 'cgroup-for-6.19-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup fix from Tejun Heo:

 - Fix a spurious cpuset warning when disabling remote partition after
   CPU hotplug leaves subpartitions_cpus empty. Guard the warning and
   invalidate affected partitions.

* tag 'cgroup-for-6.19-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cpuset: fix warning when disabling remote partition
2025-12-28 17:19:09 -08:00
Linus Torvalds
a69eddfd17 This push contains the following changes:
- Fix UAF in seqiv.
 - Fix regression in hisilicon.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmlRy74ACgkQxycdCkmx
 i6c72BAAhTJWUYKnI3KW65wCLObVR10AL5Hp/kYTRE2eOwkmnNXjlJVe80mnPhaU
 K64l0wsAKCkMjw3O0/KXH3nxqXN0+f67r5FZY07GJBj2yIQzTON2X1DxNcJ3DaUY
 CWEHJXtjipZu9f23K4fuHUQ5jxcvkigrH8Z5cfJ6I/KD/NpsbXUunEnkfV9QTDnX
 BKVEu7t9hdFX0OTLWTFUIAAlnS3Onu67F2uD1voLujBG+2aUNjuIk6ToAjKPTiam
 u03YigOsTsZBOgjM4O60rX33X/XJan2uNTkmvQQIUXWDB0ZvDvvXGZbxayEZXnSJ
 exWWv81uL4jAV76CYWSka8ILxdsqAIjlESnm8Vjn3YuVvEwQoI9Lvpyje64xv1ZR
 MqjfLXKrczu0NgKqP9GN9CqB3Yp6KxX7Xe+U7o+b1X/SSevoyhh18oMF1c4s9dfg
 6IqgK8byLZrge2Shpl7GsT21X9lQ9f/poUvbX9eNoyDn/EeqliR1i+4ydgaCW5Rx
 mK0UDwOpCxCAwd1H02Hy7bExAZnGwKXFsJJHSeHk/9y6gPmht+B4b5tGgDnkTCeu
 od6RXuAwKN+LKhNAybZSw1leEkvD48xggvRFtXg56nsqT4adbgL0QOPB3/iF01gt
 5LQu3I9vc4cjPj6Sx/tpTpkvyBog2C/sYMuHTl70UwpnloDcaKA=
 =vH+M
 -----END PGP SIGNATURE-----

Merge tag 'v6.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:

 - Fix UAF in seqiv

 - Fix regression in hisilicon

* tag 'v6.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: hisilicon/qm - fix incorrect judgment in qm_get_complete_eqe_num()
  crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
2025-12-28 16:55:16 -08:00
Harshita Bhilwaria
961ac9d97b crypto: qat - fix duplicate restarting msg during AER error
The restarting message from PF to VF is sent twice during AER error
handling: once from adf_error_detected() and again from
adf_disable_sriov().
This causes userspace subservices to shutdown unexpectedly when they
receive a duplicate restarting message after already being restarted.

Avoid calling adf_pf2vf_notify_restarting() and
adf_pf2vf_wait_for_restarting_complete() from adf_error_detected() so
that the restarting msg is sent only once from PF to VF.

Fixes: 9567d3dc76 ("crypto: qat - improve aer error reset handling")
Signed-off-by: Harshita Bhilwaria <harshita.bhilwaria@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Ravikumar PM <ravikumar.pm@intel.com>
Reviewed-by: Srikanth Thokala <srikanth.thokala@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-12-29 08:44:14 +08:00
Linus Torvalds
f8f9c1f4d0 Linux 6.19-rc3 2025-12-28 13:24:26 -08:00
Alper Ak
acf44a2361 vfio/xe: Fix use-after-free in xe_vfio_pci_alloc_file()
migf->filp is accessed after migf has been freed. Save the error
value before calling kfree() to prevent use-after-free.

Fixes: 1f5556ec8b ("vfio/xe: Add device specific vfio_pci driver variant for Intel graphics")
Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Link: https://lore.kernel.org/r/20251225151349.360870-1-alperyasinak1@gmail.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
2025-12-28 12:42:46 -07:00
Zilin Guan
665077d78d vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
pds_vfio_dirty_enable() allocates memory for region_info. If
interval_tree_iter_first() returns NULL, the function returns -EINVAL
immediately without freeing the allocated memory, causing a memory leak.

Fix this by jumping to the out_free_region_info label to ensure
region_info is freed.

Fixes: 2e7c6feb4e ("vfio/pds: Add multi-region support")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Link: https://lore.kernel.org/r/20251225143150.1117366-1-zilin@seu.edu.cn
Signed-off-by: Alex Williamson <alex@shazbot.org>
2025-12-28 12:33:40 -07:00
Linus Torvalds
c875a6c324 USB fixes for 6.19-rc3
Here are some small USB fixes, and bunch of reverts for 6.19-rc3.
 Included in here are:
   - reverts of some typec ucsi driver changes that had a lot of
     regression reports after -rc1.  Let's just revert it all for now and
     it will come back in a way that is better tested.
   - other typec bugfixes
   - usb-storage quirk fixups
   - dwc3 driver fix
   - other minor USB fixes for reported problems.
 
 All of these have passed 0-day testing and individual testing.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaVElGw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ylMeQCgzsZZNX7AtfUXlHkFENzlKFyAYZEAn0Nl01xd
 BBKmE3GqGMWsVIJ2T0AI
 =cjZ8
 -----END PGP SIGNATURE-----

Merge tag 'usb-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some small USB fixes, and bunch of reverts for 6.19-rc3.
  Included in here are:

   - reverts of some typec ucsi driver changes that had a lot of
     regression reports after -rc1. Let's just revert it all for now and
     it will come back in a way that is better tested.

   - other typec bugfixes

   - usb-storage quirk fixups

   - dwc3 driver fix

   - other minor USB fixes for reported problems.

  All of these have passed 0-day testing and individual testing"

* tag 'usb-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (22 commits)
  Revert "usb: typec: ucsi: Update UCSI structure to have message in and message out fields"
  Revert "usb: typec: ucsi: Add support for message out data structure"
  Revert "usb: typec: ucsi: Enable debugfs for message_out data structure"
  Revert "usb: typec: ucsi: Add support for SET_PDOS command"
  Revert "usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common"
  Revert "usb: typec: ucsi: Get connector status after enable notifications"
  usb: ohci-nxp: clean up probe error labels
  usb: gadget: lpc32xx_udc: clean up probe error labels
  usb: ohci-nxp: fix device leak on probe failure
  usb: phy: isp1301: fix non-OF device reference imbalance
  usb: gadget: lpc32xx_udc: fix clock imbalance in error path
  usb: typec: ucsi: Get connector status after enable notifications
  usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
  usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe
  usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common
  USB: lpc32xx_udc: Fix error handling in probe
  usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe()
  usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
  usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc()
  usb: typec: ucsi: huawei-gaokin: add DRM dependency
  ...
2025-12-28 10:21:47 -08:00
Linus Torvalds
15225b910c Serial driver fixes for 6.19-rc3
Here are some small serial driver fixes for some reported issues.
 Included in here are:
   - serial sysfs fwnode fix that was much reported
   - sh-sci driver fix
   - serial device init bugfix
   - 8250 bugfix
   - xilinx_uartps bugfix
 
 All of these have passed 0-day testing and individual testing
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaVEl7A8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yn1AgCfYUqy05A3BNhwOfhzoJ2ToKn/aZkAn0iYT/06
 vLBTQBtVhoMff9CneVvu
 =eNi3
 -----END PGP SIGNATURE-----

Merge tag 'tty-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull serial driver fixes from Greg KH:
 "Here are some small serial driver fixes for some reported issues.
  Included in here are:

   - serial sysfs fwnode fix that was much reported

   - sh-sci driver fix

   - serial device init bugfix

   - 8250 bugfix

   - xilinx_uartps bugfix

  All of these have passed 0-day testing and individual testing"

* tag 'tty-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: xilinx_uartps: fix rs485 delay_rts_after_send
  serial: sh-sci: Check that the DMA cookie is valid
  serial: core: Fix serial device initialization
  serial: 8250: longson: Fix NULL vs IS_ERR() bug in probe
  serial: core: Restore sysfs fwnode information
2025-12-28 10:14:49 -08:00
Linus Torvalds
1c55bc8710 firewire fixes for 6.19-rc3
A fix for PCI driver for Texas Instruments PCILyx series. The driver had
 a bug where it allocated a DMA-coherent buffer of 16 KB but released it
 using PAGE_SIZE. This disproportion was reported in 2020, but the fix was
 never merged. It is finally resolved.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCaVEkHAAKCRCsLtaWM8Lw
 E47xAQCakWPjeQ1S64vK9lmNAcUjWRw/YhacDLVv3euEBjSzuwEAwvK3pPv95IlA
 fO6V8UVJN+Lg5dwusM+fdleZqvR4mQ4=
 =UZIn
 -----END PGP SIGNATURE-----

Merge tag 'firewire-fixes-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

Pull firewire fix from Takashi Sakamoto:
 "A fix for PCI driver for Texas Instruments PCILyx series.

  The driver had a bug where it allocated a DMA-coherent buffer of 16 KB
  but released it using PAGE_SIZE. This disproportion was reported in
  2020, but the fix was never merged. It is finally resolved"

* tag 'firewire-fixes-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: nosy: Fix dma_free_coherent() size
2025-12-28 10:11:18 -08:00
Linus Torvalds
03de3e44a7 RISC-V updates for v6.19-rc3
- Add probing and userspace reporting support for the standard RISC-V
   ISA extensions Zilsd and Zclsd, which implement load/store dual
   instructions on RV32
 
 - Abstract the register saving code in setup_sigcontext() so it can be
   used for stateful RISC-V ISA extensions beyond the vector extension
 
 - Add the SBI extension ID and some initial data structure definitions
   for the RISC-V standard SBI debug trigger extension
 
 - Clean up some code slightly: change some page table functions to
   avoid atomic operations oinn !SMP and to avoid unnecessary casts to
   atomic_long_t; and use the existing RISCV_FULL_BARRIER macro in
   place of some open-coded "fence rw,rw" instructions
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmlQ5hUACgkQx4+xDQu9
 KkuzjQ/+LV27EOKp3ofhkN6yD+u/MZJv2L8d/L+iuZ6mC7ynerVqY7jHj1bUtSWG
 lGJPLLtB3rWITsN0tTkQZDE+LySABACvGsHsH0jDOPu25EUu8fmKL+4UOBpJ4EmH
 GrldJCgJjZiV9/NdFqUSwpsZKfuNC3IT5hQvEfFmBGexMb4O0ch2LTrqNTxsS5eu
 x1a5DJPbls8olyTYYMoIIbQMU35bHdQWSGEUBvKpisziD11E5c9P9zZcN/X7TnFZ
 9wxDCeCmdtiayJzWECRO5HFErxw16IWOBsW7JwanOLlJuE2vi/hEW3bwAAQMaYSh
 FvN6ID9d6fE9cuStNfqILuWeF8cogVkowMzEX9ud6hFp8AKE/mAlF4Rd26qIAbwE
 Migv/MjSuMKSYfPIcJ+fkrMoPgMeMCoGW34NtSV7MjSujBYozjjnN/Yc5iSu5rdN
 16b08rtusMvQI0Eowt21RO7iXRauK1+6Xcag5WZytD+sdMZkPxOepDK/mZijiida
 w8FYENlHEjhlF7A9Uiy8igVCjXJg63r3ctcnzB2wskUb+gfJF9IXdpv0O7ZO6IoJ
 6Q4OI3oNhHSWic7noXYu+dSbTT4DjlPpUBnI79X7bPo+6Ck3X9fr8YPpHzKnmHN9
 aVixfWk8zShNutROkt+3vQYzgNACcNtMT9Uz5Ce2FI3urqALp1M=
 =Pgyz
 -----END PGP SIGNATURE-----

Merge tag 'riscv-for-linus-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux

Pull RISC-V updates from Paul Walmsley:
 "Nothing exotic here; these are the cleanup and new ISA extension
  probing patches (not including CFI):

   - Add probing and userspace reporting support for the standard RISC-V
     ISA extensions Zilsd and Zclsd, which implement load/store dual
     instructions on RV32

   - Abstract the register saving code in setup_sigcontext() so it can
     be used for stateful RISC-V ISA extensions beyond the vector
     extension

   - Add the SBI extension ID and some initial data structure
     definitions for the RISC-V standard SBI debug trigger extension

   - Clean up some code slightly: change some page table functions to
     avoid atomic operations oinn !SMP and to avoid unnecessary casts to
     atomic_long_t; and use the existing RISCV_FULL_BARRIER macro in
     place of some open-coded 'fence rw,rw' instructions"

* tag 'riscv-for-linus-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: Add SBI debug trigger extension and function ids
  riscv/atomic.h: use RISCV_FULL_BARRIER in _arch_atomic* function.
  riscv: hwprobe: export Zilsd and Zclsd ISA extensions
  riscv: add ISA extension parsing for Zilsd and Zclsd
  dt-bindings: riscv: add Zilsd and Zclsd extension descriptions
  riscv: mm: use xchg() on non-atomic_long_t variables, not atomic_long_xchg()
  riscv: mm: ptep_get_and_clear(): avoid atomic ops when !CONFIG_SMP
  riscv: mm: pmdp_huge_get_and_clear(): avoid atomic ops when !CONFIG_SMP
  riscv: signal: abstract header saving for setup_sigcontext
2025-12-28 09:44:26 -08:00
Linus Torvalds
cd80afff48 powerpc fixes for 6.19 #2
- Fix for kexec warning due to SMT disable or partial SMT enabled
  - Handle font bitmap pointer with reloc_offset to fix boot crash
  - Fix to enable cpuidle state for Power11
  - Couple of misc fixes
 
 Thanks to: Aboorva Devarajan, Aditya Bodkhe, Cedar Maxwell, Christian Zigotzky, Christophe Leroy, Christophe Leroy (CS GROUP), Finn Thain, Gopi Krishna Menon, Guenter Roeck, Jan Stancek, Joe Lawrence, Josh Poimboeuf, Justin M. Forbes, Madadi Vineeth Reddy, Naveen N Rao (AMD), Nysal Jan K.A., Sachin P Bappalige, Samir M, Sourabh Jain, Srikar Dronamraju, Stan Johnson
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEqX2DNAOgU8sBX3pRpnEsdPSHZJQFAmlQnssACgkQpnEsdPSH
 ZJTVyg//f3NGQ3WJPWm0bx162qM8H1sExsdji6ra7ViDx/0fx93RjU23bmvn/zc1
 Dirfk224xyYHTXIz9Crd6cESao6RgECqucolnjDyZFg0ip2Ew8yIkL386h50NVhL
 IuMeWrAwj7QE5mJ5hvqq1019MAq2sk6WvIOJACqzbogVH8k4E119LnzrvNk6phOX
 aQr9RvpIrfA5TmReG8PT5owkFPr8yiqV4Gz7p4JOKgruvkAj5zJk2FLEOh7yU9/Q
 Wcqrp3m3F2Gl3QCdj8F5gQGDUU3sxapgRrjOQZTTJckfDJcYDz9W9XteBVXicVMr
 Uc2Lzgps5fnjORQYXQi/q6Z1XeHTCsO9CAM81l9zGmeg/J53CUI4SMumQn+kEdSN
 lLpNecU6YDrae1QdT97o18tpWPQSueAapv/Uxnn2goY8Q80IZyhY6iy8ITdbEK0x
 CqAyqFNWfpNJIt2PLCUVzfcVJ7iPCQBTBVCTKJSUmlxOScadj+UKDACGKZIN/jtR
 CNBcoM4Ciz4Po1KLFhbfHqp0ixuxHRPfaS+1UyIfKHEYwoNvpCHlXtBf9qQYW92h
 07/4ou6uzTmfuvyAQ8iY67/cMWDFocz3ephViOzmiCiEg445xx6w94CGiWp0QFCP
 D6wYlDh48IxH8iia4r7r/IB0r1Bw7gygUM/zeu5weMnvxmcUwII=
 =mQlX
 -----END PGP SIGNATURE-----

Merge tag 'powerpc-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Pull powerpc fixes from Madhavan Srinivasan:

 - Fix for kexec warning due to SMT disable or partial SMT enabled

 - Handle font bitmap pointer with reloc_offset to fix boot crash

 - Fix to enable cpuidle state for Power11

 - Couple of misc fixes

Thanks to Aboorva Devarajan, Aditya Bodkhe, Cedar Maxwell, Christian
Zigotzky, Christophe Leroy, Christophe Leroy (CS GROUP), Finn Thain,
Gopi Krishna Menon, Guenter Roeck, Jan Stancek, Joe Lawrence, Josh
Poimboeuf, Justin M. Forbes, Madadi Vineeth Reddy, Naveen N Rao (AMD),
Nysal Jan K.A., Sachin P Bappalige, Samir M, Sourabh Jain, Srikar
Dronamraju, and Stan Johnson

* tag 'powerpc-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/32: Restore disabling of interrupts at interrupt/syscall exit
  powerpc/powernv: Enable cpuidle state detection for POWER11
  powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf()
  powerpc/tools: drop `-o pipefail` in gcc check scripts
  selftests/powerpc/pmu/: Add check_extended_reg_test to .gitignore
  powerpc/kexec: Enable SMT before waking offline CPUs
2025-12-28 09:40:09 -08:00
Ming Lei
a2ce133969 selftests/ublk: fix Makefile to rebuild on header changes
Add header dependencies to kublk build rule so that changes to
kublk.h, ublk_dep.h, or utils.h trigger a rebuild.

Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28 09:25:26 -07:00
Ming Lei
60cf863720 selftests/ublk: add test for async partition scan
Add test_generic_15.sh to verify that async partition scan prevents
IO hang when reading partition tables.

The test creates ublk devices with fault_inject target and very large
delay (60s) to simulate blocked partition table reads, then kills the
daemon to verify proper state transitions without hanging:

1. Without recovery support:
   - Create device with fault_inject and 60s delay
   - Kill daemon while partition scan may be blocked
   - Verify device transitions to DEAD state

2. With recovery support (-r 1):
   - Create device with fault_inject, 60s delay, and recovery
   - Kill daemon while partition scan may be blocked
   - Verify device transitions to QUIESCED state

Before the async partition scan fix, killing the daemon during
partition scan would cause deadlock as partition scan held ub->mutex
while waiting for IO. With the async fix, partition scan happens in
a work function and flush_work() ensures proper synchronization.

Add _add_ublk_dev_no_settle() helper function to skip udevadm settle,
which would otherwise hang waiting for partition scan events to
complete when partition table read is delayed.

Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28 09:25:26 -07:00
Ming Lei
7fc4da6a30 ublk: scan partition in async way
Implement async partition scan to avoid IO hang when reading partition
tables. Similar to nvme_partition_scan_work(), partition scanning is
deferred to a work queue to prevent deadlocks.

When partition scan happens synchronously during add_disk(), IO errors
can cause the partition scan to wait while holding ub->mutex, which
can deadlock with other operations that need the mutex.

Changes:
- Add partition_scan_work to ublk_device structure
- Implement ublk_partition_scan_work() to perform async scan
- Always suppress sync partition scan during add_disk()
- Schedule async work after add_disk() for trusted daemons
- Add flush_work() in ublk_stop_dev() before grabbing ub->mutex

Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
Reported-by: Yoav Cohen <yoav@nvidia.com>
Closes: https://lore.kernel.org/linux-block/DM4PR12MB63280C5637917C071C2F0D65A9A8A@DM4PR12MB6328.namprd12.prod.outlook.com/
Fixes: 71f28f3136 ("ublk_drv: add io_uring based userspace block driver")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28 09:25:26 -07:00
Kohei Enju
c9894e6f01 tools/sched_ext: update scx_show_state.py for scx_aborting change
Commit a69040ed57 ("sched_ext: Simplify breather mechanism with
scx_aborting flag") removed scx_in_softlockup and scx_breather_depth,
replacing them with scx_aborting.

Update the script accordingly.

Fixes: a69040ed57 ("sched_ext: Simplify breather mechanism with scx_aborting flag")
Signed-off-by: Kohei Enju <enjuk@amazon.com>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2025-12-28 06:11:26 -10:00
Kohei Enju
f92ff79ba2 tools/sched_ext: fix scx_show_state.py for scx_root change
Commit 48e1267773 ("sched_ext: Introduce scx_sched") introduced
scx_root and removed scx_ops, causing scx_show_state.py to fail when
searching for the 'scx_ops' object. [1]

Fix by using 'scx_root' instead, with NULL pointer handling.

[1]
 # drgn -s vmlinux ./tools/sched_ext/scx_show_state.py
 Traceback (most recent call last):
   File "/root/.venv/bin/drgn", line 8, in <module>
     sys.exit(_main())
              ~~~~~^^
   File "/root/.venv/lib64/python3.14/site-packages/drgn/cli.py", line 625, in _main
     runpy.run_path(
     ~~~~~~~~~~~~~~^
         script_path, init_globals={"prog": prog}, run_name="__main__"
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     )
     ^
   File "<frozen runpy>", line 287, in run_path
   File "<frozen runpy>", line 98, in _run_module_code
   File "<frozen runpy>", line 88, in _run_code
   File "./tools/sched_ext/scx_show_state.py", line 30, in <module>
     ops = prog['scx_ops']
           ~~~~^^^^^^^^^^^
 _drgn.ObjectNotFoundError: could not find 'scx_ops'

Fixes: 48e1267773 ("sched_ext: Introduce scx_sched")
Signed-off-by: Kohei Enju <enjuk@amazon.com>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2025-12-28 06:11:13 -10:00
shechenglong
04bdb1a04d block,bfq: fix aux stat accumulation destination
Route bfqg_stats_add_aux() time accumulation into the destination
stats object instead of the source, aligning with other stat fields.

Reviewed-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: shechenglong <shechenglong@xfusion.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28 09:03:51 -07:00
Jens Axboe
4d1442979e af_unix: don't post cmsg for SO_INQ unless explicitly asked for
A previous commit added SO_INQ support for AF_UNIX (SOCK_STREAM), but it
posts a SCM_INQ cmsg even if just msg->msg_get_inq is set. This is
incorrect, as ->msg_get_inq is just the caller asking for the remainder
to be passed back in msg->msg_inq, it has nothing to do with cmsg. The
original commit states that this is done to make sockets
io_uring-friendly", but it's actually incorrect as io_uring doesn't use
cmsg headers internally at all, and it's actively wrong as this means
that cmsg's are always posted if someone does recvmsg via io_uring.

Fix that up by only posting a cmsg if u->recvmsg_inq is set.

Additionally, mirror how TCP handles inquiry handling in that it should
only be done for a successful return. This makes the logic for the two
identical.

Cc: stable@vger.kernel.org
Fixes: df30285b36 ("af_unix: Introduce SO_INQ.")
Reported-by: Julian Orth <ju.orth@gmail.com>
Link: https://github.com/axboe/liburing/issues/1509
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/07adc0c2-2c3b-4d08-8af1-1c466a40b6a8@kernel.dk
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28 16:11:22 +01:00
Greg Kroah-Hartman
d8aef84e60 Counter fixes for 6.19
A fix for interrupt-cnt dropping the IRQF_NO_THREAD configuration to
 allow the IRQ handler to correctly acquire a spinlock_t lock. A fix for
 104-quad-8 correcting quad8_irq_handler() to return irqreturn_t enum
 values rather than negative errno codes on error.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSNN83d4NIlKPjon7a1SFbKvhIjKwUCaVC8aQAKCRC1SFbKvhIj
 KzQ/AP45852Cd6hFisjAhbKm5+NFLN3cJX7ZnISpoG9G5it+0wD/aCUbuMJcPjAJ
 Zyk/cVSvNYCNfTVQ0jgeCH44UfbRFQg=
 =rNX8
 -----END PGP SIGNATURE-----

Merge tag 'counter-fixes-for-6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-linus

William writes:

Counter fixes for 6.19

A fix for interrupt-cnt dropping the IRQF_NO_THREAD configuration to
allow the IRQ handler to correctly acquire a spinlock_t lock. A fix for
104-quad-8 correcting quad8_irq_handler() to return irqreturn_t enum
values rather than negative errno codes on error.

* tag 'counter-fixes-for-6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter:
  counter: 104-quad-8: Fix incorrect return value in IRQ handler
  counter: interrupt-cnt: Drop IRQF_NO_THREAD flag
2025-12-28 13:54:54 +01:00
Rafael J. Wysocki
684d3b2670 PM: sleep: Fix suspend_test() at the TEST_CORE level
Commit a10ad1b104 ("PM: suspend: Make pm_test delay interruptible by
wakeup events") replaced mdelay() in suspend_test() with msleep() which
does not work at the TEST_CORE test level that calls suspend_test()
while running on one CPU with interrupts off.

Address this by making suspend_test() check if the test level is
suitable for using msleep() and use mdelay() otherwise.

Fixes: a10ad1b104 ("PM: suspend: Make pm_test delay interruptible by wakeup events")
Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Closes: https://lore.kernel.org/linux-pm/aUsAk0k1N9hw8IkY@venus/
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Tested-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://patch.msgid.link/6251576.lOV4Wx5bFT@rafael.j.wysocki
2025-12-28 13:01:39 +01:00
Dipayaan Roy
3387a7ad47 net: mana: Fix use-after-free in reset service rescan path
When mana_serv_reset() encounters -ETIMEDOUT or -EPROTO from
mana_gd_resume(), it performs a PCI rescan via mana_serv_rescan().

mana_serv_rescan() calls pci_stop_and_remove_bus_device(), which can
invoke the driver's remove path and free the gdma_context associated
with the device. After returning, mana_serv_reset() currently jumps to
the out label and attempts to clear gc->in_service, dereferencing a
freed gdma_context.

The issue was observed with the following call logs:
[  698.942636] BUG: unable to handle page fault for address: ff6c2b638088508d
[  698.943121] #PF: supervisor write access in kernel mode
[  698.943423] #PF: error_code(0x0002) - not-present page
[S[  698.943793] Pat Dec  6 07:GD5 100000067 P4D 1002f7067 PUD 1002f8067 PMD 101bef067 PTE 0
0:56 2025] hv_[n e 698.944283] Oops: Oops: 0002 [#1] SMP NOPTI
tvsc f8615163-00[  698.944611] CPU: 28 UID: 0 PID: 249 Comm: kworker/28:1
...
[Sat Dec  6 07:50:56 2025] R10: [  699.121594] mana 7870:00:00.0 enP30832s1: Configured vPort 0 PD 18 DB 16
000000000000001b R11: 0000000000000000 R12: ff44cf3f40270000
[Sat Dec  6 07:50:56 2025] R13: 0000000000000001 R14: ff44cf3f402700c8 R15: ff44cf3f4021b405
[Sat Dec  6 07:50:56 2025] FS:  0000000000000000(0000) GS:ff44cf7e9fcf9000(0000) knlGS:0000000000000000
[Sat Dec  6 07:50:56 2025] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[Sat Dec  6 07:50:56 2025] CR2: ff6c2b638088508d CR3: 000000011fe43001 CR4: 0000000000b73ef0
[Sat Dec  6 07:50:56 2025] Call Trace:
[Sat Dec  6 07:50:56 2025]  <TASK>
[Sat Dec  6 07:50:56 2025]  mana_serv_func+0x24/0x50 [mana]
[Sat Dec  6 07:50:56 2025]  process_one_work+0x190/0x350
[Sat Dec  6 07:50:56 2025]  worker_thread+0x2b7/0x3d0
[Sat Dec  6 07:50:56 2025]  kthread+0xf3/0x200
[Sat Dec  6 07:50:56 2025]  ? __pfx_worker_thread+0x10/0x10
[Sat Dec  6 07:50:56 2025]  ? __pfx_kthread+0x10/0x10
[Sat Dec  6 07:50:56 2025]  ret_from_fork+0x21a/0x250
[Sat Dec  6 07:50:56 2025]  ? __pfx_kthread+0x10/0x10
[Sat Dec  6 07:50:56 2025]  ret_from_fork_asm+0x1a/0x30
[Sat Dec  6 07:50:56 2025]  </TASK>

Fix this by returning immediately after mana_serv_rescan() to avoid
accessing GC state that may no longer be valid.

Fixes: 9bf66036d6 ("net: mana: Handle hardware recovery events when probing the device")
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Long Li <longli@microsoft.com>
Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com>
Link: https://patch.msgid.link/20251218131054.GA3173@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28 10:34:00 +01:00
Eric Dumazet
c04de0c795 net: avoid prefetching NULL pointers
Aditya Gupta reported PowerPC crashes bisected to the blamed commit.

Apparently some platforms do not allow prefetch() on arbitrary pointers.

  prefetch(next);
  prefetch(&next->priority); // CRASH when next == NULL

Only NULL seems to be supported, with specific handling in prefetch().

Add a conditional to avoid the two prefetches and the skb->next clearing
for the last skb in the list.

Fixes: b2e9821cff ("net: prefech skb->priority in __dev_xmit_skb()")
Reported-by: Aditya Gupta <adityag@linux.ibm.com>
Closes: https://lore.kernel.org/netdev/e9f4abee-b132-440f-a50e-bced0868b5a7@linux.ibm.com/T/#mddc372b64ec5a3b181acc9ee3909110c391cc18a
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Aditya Gupta <adityag@linux.ibm.com>
Link: https://patch.msgid.link/20251218081844.809008-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28 10:19:11 +01:00
Bagas Sanjaya
f79f9b7ace net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
Sphinx reports kernel-doc warning:

WARNING: ./net/bridge/br_private.h:267 struct member 'tunnel_hash' not described in 'net_bridge_vlan_group'

Fix it by describing @tunnel_hash member.

Fixes: efa5356b0d ("bridge: per vlan dst_metadata netlink support")
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20251218042936.24175-2-bagasdotme@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28 10:17:14 +01:00
Deepanshu Kartikey
1ab526d97a net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
A deadlock can occur between nfc_unregister_device() and rfkill_fop_write()
due to lock ordering inversion between device_lock and rfkill_global_mutex.

The problematic lock order is:

Thread A (rfkill_fop_write):
  rfkill_fop_write()
    mutex_lock(&rfkill_global_mutex)
      rfkill_set_block()
        nfc_rfkill_set_block()
          nfc_dev_down()
            device_lock(&dev->dev)    <- waits for device_lock

Thread B (nfc_unregister_device):
  nfc_unregister_device()
    device_lock(&dev->dev)
      rfkill_unregister()
        mutex_lock(&rfkill_global_mutex)  <- waits for rfkill_global_mutex

This creates a classic ABBA deadlock scenario.

Fix this by moving rfkill_unregister() and rfkill_destroy() outside the
device_lock critical section. Store the rfkill pointer in a local variable
before releasing the lock, then call rfkill_unregister() after releasing
device_lock.

This change is safe because rfkill_fop_write() holds rfkill_global_mutex
while calling the rfkill callbacks, and rfkill_unregister() also acquires
rfkill_global_mutex before cleanup. Therefore, rfkill_unregister() will
wait for any ongoing callback to complete before proceeding, and
device_del() is only called after rfkill_unregister() returns, preventing
any use-after-free.

The similar lock ordering in nfc_register_device() (device_lock ->
rfkill_global_mutex via rfkill_register) is safe because during
registration the device is not yet in rfkill_list, so no concurrent
rfkill operations can occur on this device.

Fixes: 3e3b5dfcd1 ("NFC: reorder the logic in nfc_{un,}register_device")
Cc: stable@vger.kernel.org
Reported-by: syzbot+4ef89409a235d804c6c2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4ef89409a235d804c6c2
Link: https://lore.kernel.org/all/20251217054908.178907-1-kartikey406@gmail.com/T/ [v1]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20251218012355.279940-1-kartikey406@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28 09:15:42 +01:00
Deepanshu Kartikey
a1e077a3f7 net: usb: asix: validate PHY address before use
The ASIX driver reads the PHY address from the USB device via
asix_read_phy_addr(). A malicious or faulty device can return an
invalid address (>= PHY_MAX_ADDR), which causes a warning in
mdiobus_get_phy():

  addr 207 out of range
  WARNING: drivers/net/phy/mdio_bus.c:76

Validate the PHY address in asix_read_phy_addr() and remove the
now-redundant check in ax88172a.c.

Reported-by: syzbot+3d43c9066a5b54902232@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3d43c9066a5b54902232
Tested-by: syzbot+3d43c9066a5b54902232@syzkaller.appspotmail.com
Fixes: 7e88b11a86 ("net: usb: asix: refactor asix_read_phy_addr() and handle errors on return")
Link: https://lore.kernel.org/all/20251217085057.270704-1-kartikey406@gmail.com/T/ [v1]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20251218011156.276824-1-kartikey406@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28 09:05:12 +01:00
Rosen Penev
a4f800c448 net: mdio: rtl9300: use scoped for loops
Currently in the return path, fwnode_handle_put calls are missing. Just use
_scoped to avoid the issue.

Fixes: 24e31e4747 ("net: mdio: Add RTL9300 MDIO driver")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20251217210153.14641-1-rosenp@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28 08:55:48 +01:00
Arnaldo Carvalho de Melo
fe072f6510 tools build: Fix the common set of features test wrt libopenssl
The recent introduction of the libopenssl feature test forgot to add the
-lssl to the test-all.o target, which made it always fail, fix it.

Noticed by looking at this file after building:

  $ cat /tmp/build/perf-tools/feature/test-all.make.output
  /usr/bin/ld: /tmp/ccBhO8WH.ltrans0.ltrans.o: in function `main':
  /home/acme/git/perf-tools/tools/build/feature/test-libopenssl.c:6:(.text.startup+0x2ed): undefined reference to `OPENSSL_init_ssl'
  collect2: error: ld returned 1 exit status
  $

It was added only to the individual ssl test, that works:

  $ cat /tmp/build/perf-tools/feature/test-libopenssl.make.output
  $ ldd /tmp/build/perf-tools/feature/test-libopenssl.bin | grep ssl
	libssl.so.3 => /usr/lib64/libssl.so.3 (0x00007fb81eda8000)
  $

Fixes: 7678523109 ("tools/build: Add a feature test for libopenssl")
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2025-12-27 20:26:44 -08:00
Jose Javier Rodriguez Barbarin
1f4ea4838b
mcb: Add missing modpost build support
mcb bus is not prepared to autoload client drivers with the data defined on
the drivers' MODULE_DEVICE_TABLE. modpost cannot access to mcb_table_id
inside MODULE_DEVICE_TABLE so the data declared inside is ignored.

Add modpost build support for accessing to the mcb_table_id coded on device
drivers' MODULE_DEVICE_TABLE.

Fixes: 3764e82e51 ("drivers: Introduce MEN Chameleon Bus")
Reviewed-by: Jorge Sanjuan Garcia <dev-jorge.sanjuangarcia@duagon.com>
Signed-off-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com>
Acked-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Link: https://patch.msgid.link/20251202084200.10410-1-dev-josejavier.rodriguez@duagon.com
Signed-off-by: Nicolas Schier <nsc@kernel.org>
2025-12-27 20:48:01 +01:00
Thomas De Schampheleire
b08fc4d0ec
kbuild: fix compilation of dtb specified on command-line without make rule
Since commit e7e2941300 ("kbuild: split device tree build rules into
scripts/Makefile.dtbs"), it is no longer possible to compile a device tree
blob that is not specified in a make rule
like:
    dtb-$(CONFIG_FOO) += foo.dtb

Before the mentioned commit, one could copy a dts file to e.g.
arch/arm64/boot/dts/ (or a new subdirectory) and then convert it to a dtb
file using:
    make ARCH=arm64 foo.dtb

In this scenario, both 'dtb-y' and 'dtb-' are empty, and the inclusion of
scripts/Makefile.dtbs relies on 'targets' to contain the MAKECMDGOALS. The
value of 'targets', however, is only final later in the code.

Move the conditional include of scripts/Makefile.dtbs down to where the
value of 'targets' is final. Since Makefile.dtbs updates 'always-y' which is
used as a prerequisite in the build rule, the build rule also needs to move
down.

Fixes: e7e2941300 ("kbuild: split device tree build rules into scripts/Makefile.dtbs")
Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20251126100017.1162330-1-thomas.de_schampheleire@nokia.com
Signed-off-by: Nicolas Schier <nsc@kernel.org>
2025-12-27 20:48:01 +01:00
Nicolas Schier
07fe35b766
Revert "scripts/clang-tools: Handle included .c files in gen_compile_commands"
This reverts commit 9362d34acf.

Dmitry Vyukov reported that commit 9362d34acf ("scripts/clang-tools:
Handle included .c files in gen_compile_commands") generates false
entries in some cases for C files that are included in other C files but
not meant for standalone compilation.

For properly supporting clangd, including .c files is discouraged.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Closes: https://lore.kernel.org/r/CACT4Y+Z8aCz0XcoJx9XXPHZSZHxGF8Kx9iUbFarhpTSEPDhMfg@mail.gmail.com
Acked-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Dmitry Vyukov <dvyukov@google.com>
Fixes: 9362d34acf ("scripts/clang-tools: Handle included .c files in gen_compile_commands")
Link: https://patch.msgid.link/20251217-revert-scripts-clang-rools-handle-included-c-files-v1-1-def5651446da@kernel.org
Signed-off-by: Nicolas Schier <nsc@kernel.org>
2025-12-27 20:48:01 +01:00
Linus Torvalds
d26143bb38 spi: Fixes for v6.19
We've got more fixes here for the Cadence QSPI controller, this time
 fixing some issues that come up when working with slower flashes on some
 platforms plus a general race condition.
 
 We also add support for the Allwinner A523, this is just some new
 compatibles.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmlPvm0ACgkQJNaLcl1U
 h9BwWgf+MWIgqU0Rh8de+IiEkrfp82V9Xz5ZNKqgtvlyJdp41QG3SAukmy2LBtYK
 RO9RzZcaBse/uLvEgZZO9sEvPgQHakn0p60EgJEhwKHP+lCt1EfaDKv1kbvAATwl
 urtZE8YDHu6SITJvPobmIykCgr/yODpcMWfyyRNxmoZFb3LYQiXV3pbWem0VBdn/
 ZJ2QBEKYyLSkYgqiZmhosgGyWI8nXml7xhHY6EunvbWWXb599aQoPS44Y3aTwftB
 8lZ4fMWTGwTsRqc0eh2dCrVCLNpGLSM4T0/R2VvpW058Tu877yD+4w4vd1O++2kF
 HbphKV5TvUUpR+Ivo4LSPsQ4fGaLxg==
 =ASmz
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "We've got more fixes here for the Cadence QSPI controller, this time
  fixing some issues that come up when working with slower flashes on
  some platforms plus a general race condition.

  We also add support for the Allwinner A523, this is just some new
  compatibles"

* tag 'spi-fix-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: cadence-quadspi: Improve CQSPI_SLOW_SRAM quirk if flash is slow
  spi: cadence-quadspi: Prevent lost complete() call during indirect read
  spi: sun6i: Support A523's SPI controllers
  spi: dt-bindings: sun6i: Add compatibles for A523's SPI controllers
2025-12-27 08:37:26 -08:00
Jonas Gorski
d42bce414d net: dsa: b53: skip multicast entries for fdb_dump()
port_fdb_dump() is supposed to only add fdb entries, but we iterate over
the full ARL table, which also includes multicast entries.

So check if the entry is a multicast entry before passing it on to the
callback().

Additionally, the port of those entries is a bitmask, not a port number,
so any included entries would have even be for the wrong port.

Fixes: 1da6df85c6 ("net: dsa: b53: Implement ARL add/del/dump operations")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251217205756.172123-1-jonas.gorski@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-27 17:17:32 +01:00
Paolo Abeni
352df98b7b Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue
Tony Nguyen says:

====================
Intel Wired LAN Driver Updates 2025-12-17 (i40e, iavf, idpf, e1000)

For i40e:
Przemyslaw immediately schedules service task following changes to
filters to ensure timely setup for PTP.

Gregory Herrero adjusts VF descriptor size checks to be device specific.

For iavf:
Kohei Enju corrects a couple of condition checks which caused off-by-one
issues.

For idpf:
Larysa fixes LAN memory region call to follow expected requirements.

Brian Vazquez reduces mailbox wait time during init to avoid lengthy
delays.

For e1000:
Guangshuo Li adds validation of data length to prevent out-of-bounds
access.

* '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:
  e1000: fix OOB in e1000_tbi_should_accept()
  idpf: reduce mbx_task schedule delay to 300us
  idpf: fix LAN memory regions command on some NVMs
  iavf: fix off-by-one issues in iavf_config_rss_reg()
  i40e: validate ring_len parameter against hardware-specific values
  i40e: fix scheduling in set_rx_mode
====================

Link: https://patch.msgid.link/
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-27 17:10:42 +01:00
Linus Torvalds
651df41997 regulator: Fixes for v6.19
A couple of fixes from Thomas, making the UAPI headers more robustly
 correct and ensuring they are covered by checkpatch, and one from
 Andreas fixing an update for a change to the DT bindings that I missed
 was requested during bindings review in the newly added fp9931 driver.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmlPvaEACgkQJNaLcl1U
 h9A9Ogf9Fp1tjyQK1onQZlG9EcPGF2gZ3wTKdxEb1PZOx7ioyLUrQHtB1b1wPpEr
 Wniq2BxsG4yqGxaBPSiA7NsLe35CgozvDNy/kJXAcPsix9ZKEMtcjQuZQ9hD8fR9
 SWYLMoey/hZDu/OdF7pnmOEjm9WmXjQ1ielfaAEzwV7rgkZkWSsslj04joYsMcFX
 ESO12jea/pHBj5nI0nfSaRH5UW+spyR3KScU1Z3RP23boG3+ZtT6NK1Kyx3K+x5V
 k0d71rDcqIKn/QYEF651H0RIsrJ8BYd85QAtCW+Of4ATCNttTgeKLN8ZhC91gOns
 VlCogXA+t85KzmVtLH5Fia98lJu+ig==
 =0hFe
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fixes from Mark Brown:
 "A couple of fixes from Thomas, making the UAPI headers more robustly
  correct and ensuring they are covered by checkpatch, and one from
  Andreas fixing an update for a change to the DT bindings that I missed
  was requested during bindings review in the newly added fp9931 driver"

* tag 'regulator-fix-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: fp9931: fix regulator node pointer
  regulator: Add UAPI headers to MAINTAINERS
  regulator: uapi: Use UAPI integer type
2025-12-27 08:04:39 -08:00
Linus Torvalds
0d362c7fa1 drm fixes for 6.19-rc3
msm:
 - GPU:
   - Fix crash on a7xx GPUs not supporting IFPC
   - Fix perfcntr use with IFPC
   - Concurrent binning fix
 - DPU:
   - Fixed DSC and SSPP fetching issues
   - Switched to scnprint instead of snprintf
   - Added missing NULL checks in pingpong code
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmlPfNYACgkQDHTzWXnE
 hr7rXxAAkDrdbevUstxd6nHTy6VnqOhDKEJ3c0Gm5WzVtP52ishoolQqduu/cK1C
 IgHIFZmq0Blo24LnwsPg7jOtAcM7TtJ7Mv55fk5gZ8UL+xL2ibSbZbWLK4GsJDPx
 fPOJkGgJKWgYy6CnOcxKwrhveDkd/0AJnMujlFfKP8rAIWij9EkdgoLCfYHd7WFo
 jYlrAVmNZe3DvE/wGaHOJeCYRoM8GkG/FTcNG7azKldQEXFy3XOk8WlXA5HSp2Js
 dh4mEVUNkq3d+wPTKXCqnmXJ/RSh3cVem4g8QiEsoJo1iGIx2fJg1L11dU558l9A
 7ofMzKwTQS4+x5ISvJigj0HDv7daJ7xajlE0kE50VVETTEYwMzz4no4S5DF3Ddpb
 IQexSaBX/xTUxfWnciCt4P/ppDA9PSwWCqdAKHJ2J5Ml6i8gdttq6A8Da01b4Oe0
 mWMsdPbwQRDAuN+ezmbo56Uy1U8Hkll5xrb5bJa2y9Pl7heNXXcztAIemLtY6Cy5
 wjSZf4NZWjrzXcR+hZcXRSOxFLaGqE/LJjdrIYmB3mNh74U5EWlsE+UMQntBdaSY
 iBiMwUXy9sWG2d6cBomNxFbvTrfezVlPibSHxqb5pTM1qPQbvGG14RsrbBouRtxX
 9sovFNW6UC+pEKL1/7pG1BhnxNLeHUrv4NDgUiOGHjpDnEgvvoM=
 =HOF4
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-12-27' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Post overeating fixes, only msm for this week has anything, so quiet
  as expected.

  msm:
   - GPU:
      - Fix crash on a7xx GPUs not supporting IFPC
      - Fix perfcntr use with IFPC
      - Concurrent binning fix
   - DPU:
      - Fixed DSC and SSPP fetching issues
      - Switched to scnprint instead of snprintf
      - Added missing NULL checks in pingpong code"

* tag 'drm-fixes-2025-12-27' of https://gitlab.freedesktop.org/drm/kernel: (27 commits)
  drm/msm: Replace unsafe snprintf usage with scnprintf
  drm/msm/dpu: Add missing NULL pointer check for pingpong interface
  Revert "drm/msm/dpu: Enable quad-pipe for DSC and dual-DSI case"
  Revert "drm/msm/dpu: support plane splitting in quad-pipe case"
  drm/msm: msm_iommu.c: fix all kernel-doc warnings
  drm/msm: msm_gpu.h: fix all kernel-doc warnings
  drm/msm: msm_gem_vma.c: fix all kernel-doc warnings
  drm/msm: msm_fence.h: fix all kernel-doc warnings
  drm/msm/dpu: dpu_hw_wb.h: fix all kernel-doc warnings
  drm/msm/dpu: dpu_hw_vbif.h: fix all kernel-doc warnings
  drm/msm/dpu: dpu_hw_top.h: fix all kernel-doc warnings
  drm/msm/dpu: dpu_hw_sspp.h: fix all kernel-doc warnings
  drm/msm/dpu: dpu_hw_pingpong.h: fix all kernel-doc warnings
  drm/msm/dpu: dpu_hw_merge3d.h: fix all kernel-doc warnings
  drm/msm/dpu: dpu_hw_lm.h: fix all kernel-doc warnings
  drm/msm/dpu: dpu_hw_intf.h: fix all kernel-doc warnings
  drm/msm/dpu: dpu_hw_dspp.h: fix all kernel-doc warnings
  drm/msm/dpu: dpu_hw_dsc.h: fix all kernel-doc warnings
  drm/msm/dpu: dpu_hw_cwb.h: fix all kernel-doc warnings
  drm/msm/dpu: dpu_hw_ctl.h: fix all kernel-doc warnings
  ...
2025-12-27 07:53:56 -08:00